Skip to content

ci: harden gating workflows for branch-protection consumers (#289) #1581

ci: harden gating workflows for branch-protection consumers (#289)

ci: harden gating workflows for branch-protection consumers (#289) #1581

name: CI - Static Analysis (C Code)
on:
push:
branches: [ main, develop, 'feature/**', 'fix/**' ]
pull_request:
branches: [ main, develop ]
permissions:
contents: read
security-events: write # Required for CodeQL SARIF upload
# Collapse overlapping runs on the same ref; main is preserved.
concurrency:
group: static-analysis-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.event_name != 'schedule' }}
jobs:
cppcheck:
name: Cppcheck Static Analysis
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Install cppcheck
run: |
sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list /etc/apt/sources.list.d/azure-cli.list || true
sudo apt-get update
sudo apt-get install -y cppcheck
- name: Run cppcheck on C sources
run: |
cppcheck \
--enable=warning,style,performance,portability \
--suppress=missingIncludeSystem \
--suppress=unusedFunction \
--error-exitcode=1 \
--inline-suppr \
--std=c11 \
-I include/ \
-DAMA_USE_NATIVE_PQC \
--force \
-i src/c/vendor/ \
src/c/ 2>&1 | tee cppcheck-report.txt
- name: Upload cppcheck report
if: always()
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: cppcheck-report
path: cppcheck-report.txt
retention-days: 30
clang-analyzer:
name: Clang Static Analyzer (scan-build)
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Install dependencies
run: |
sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list /etc/apt/sources.list.d/azure-cli.list || true
sudo apt-get update
sudo apt-get install -y cmake clang clang-tools
- name: Run scan-build
run: |
mkdir -p build-scan
cd build-scan
scan-build --status-bugs \
-enable-checker security.FloatLoopCounter \
-enable-checker security.insecureAPI.UncheckedReturn \
-enable-checker alpha.security.ArrayBoundV2 \
-enable-checker alpha.security.MallocOverflow \
-enable-checker alpha.security.ReturnPtrRange \
-enable-checker alpha.security.taint.TaintPropagation \
cmake .. \
-DCMAKE_C_COMPILER=clang \
-DAMA_USE_NATIVE_PQC=ON \
-DAMA_BUILD_TESTS=OFF \
-DAMA_BUILD_EXAMPLES=OFF \
-DAMA_ENABLE_LTO=OFF
scan-build --status-bugs \
-enable-checker security.FloatLoopCounter \
-enable-checker security.insecureAPI.UncheckedReturn \
-enable-checker alpha.security.ArrayBoundV2 \
-enable-checker alpha.security.MallocOverflow \
-enable-checker alpha.security.ReturnPtrRange \
-enable-checker alpha.security.taint.TaintPropagation \
make -j$(nproc)
- name: Upload scan-build report
if: failure()
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: scan-build-report
path: /tmp/scan-build-*
retention-days: 30
codeql:
name: CodeQL Security Analysis
runs-on: ubuntu-latest
timeout-minutes: 20
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Initialize CodeQL
uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
with:
languages: c-cpp, python
queries: security-and-quality
config-file: ./.github/codeql/codeql-config.yml
- name: Build C library for CodeQL
run: |
cmake -B build \
-DAMA_USE_NATIVE_PQC=ON \
-DAMA_BUILD_TESTS=OFF \
-DAMA_BUILD_EXAMPLES=OFF \
-DAMA_ENABLE_LTO=OFF
cmake --build build -j$(nproc)
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
with:
category: "/language:c-cpp"
compiler-warnings:
name: Strict Compiler Warnings
runs-on: ubuntu-latest
timeout-minutes: 10
strategy:
fail-fast: false
matrix:
compiler: [gcc, clang]
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Install dependencies
run: |
sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list /etc/apt/sources.list.d/azure-cli.list || true
sudo apt-get update
sudo apt-get install -y cmake ${{ matrix.compiler }}
- name: Build with strict warnings (Werror)
run: |
cmake -B build-strict \
-DCMAKE_C_COMPILER=${{ matrix.compiler }} \
-DCMAKE_C_FLAGS="-Wall -Wextra -Wpedantic -Wshadow -Wformat=2 -Wconversion -Wno-sign-conversion" \
-DAMA_USE_NATIVE_PQC=ON \
-DAMA_BUILD_TESTS=ON \
-DAMA_BUILD_EXAMPLES=OFF \
-DAMA_ENABLE_LTO=OFF
cmake --build build-strict -j$(nproc)
- name: Run tests
run: cd build-strict && ctest --output-on-failure
version-consistency:
# Enforces audit 5a: every file that declares the library version must
# agree with ama_cryptography/__init__.py. Also enforces audit 6a:
# root INVARIANTS.md must stay byte-identical to .github/INVARIANTS.md
# — we inlined the full content to eliminate the dead-pointer stub, so
# CI now fails if a future edit touches only one copy.
name: Version / Invariants Consistency
runs-on: ubuntu-latest
timeout-minutes: 2
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Run version consistency check
run: python3 tools/check_version_consistency.py
address-sanitizer:
name: AddressSanitizer + UBSan
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Install dependencies
run: |
sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list /etc/apt/sources.list.d/azure-cli.list || true
sudo apt-get update
sudo apt-get install -y cmake clang
- name: Build with ASan + UBSan
run: |
cmake -B build-asan \
-DCMAKE_C_COMPILER=clang \
-DCMAKE_C_FLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer -g" \
-DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address,undefined" \
-DAMA_USE_NATIVE_PQC=ON \
-DAMA_BUILD_TESTS=ON \
-DAMA_BUILD_EXAMPLES=OFF \
-DAMA_ENABLE_LTO=OFF
cmake --build build-asan -j$(nproc)
- name: Run tests under sanitizers
env:
ASAN_OPTIONS: detect_leaks=1:detect_stack_use_after_return=1
UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1
run: cd build-asan && ctest --output-on-failure